Can you set a longer throttle_period?
I see it set to 30 minutes in your example, maybe a bigger value would be enough.
I think it's the most suitable mechanism for handling duplicate notifications.
Maybe we can suggest to the elastic devs to implement some kind of "forever" value for that parameter
If that were not possible, what comes to my mind would be much more cumbersome:
- Add another search (so chain inputs) to obtain the results of the last execution (e.g. sort a small time range) recorded in the .watcher-history-... index each time the watcher is triggered.
- Add comparison logic (so probably a script comparison) to take that values into account.
You can find related information in this question: